Baya web agent prevents prompt injections using compile-then-execute
Original title: Securing Web Agents with the Compile-Then-Execute Paradigm
Baya achieves 0% attack success on WASP benchmark compared to 25.5% for browser-only ReAct.
Web agents using ReAct are vulnerable to prompt injections in webpages. Baya compiles requests into Python programs calling Trusted Website API before execution. Planning model sees only compiled program. Evaluation shows 77.8% utility on WebArena and 0% attacks.
- 77.8% aggregate utility on 581 WebArena tasks
- 0% attack success rate on WASP benchmark
- Untrusted data cannot redefine user task
- Trusted API gives unified action space
From the original article
1 min read at arxiv.orgWeb agents commonly follow the ReAct paradigm, selecting each action from runtime observations that inherently mix trusted and untrusted content. This design makes their control flow vulnerable to prompt injections embedded in webpages. We introduce Baya, a compile-then-execute web agent designed to prevent prompt-injection-driven control-flow hijacking by design.
By Annabella Chow · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.